CVE-2026-72256 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_cluster: reject template conntracks in hash match
xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash().
This causes a state confusion bug when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing. Templates carry IPS_TEMPLATE status but do not have a valid tuple for hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the zeroed l3num field.
Reject template conntracks before hashing them. This matches existing netfilter handling for template objects and avoids hashing incomplete conntrack state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's netfilter subsystem, specifically within the xt_cluster target module that handles cluster-based connection tracking. This issue manifests as a state confusion bug that occurs when the raw table CT target attaches template conntracks to packets before standard conntrack processing takes place. The core problem emerges from the xt_cluster_mt() function which indiscriminately treats any non-NULL result from nf_ct_get() as a fully initialized conntrack object without proper validation of the conntrack's initialization state.
The technical flaw stems from inadequate state checking within the cluster matching logic where template conntracks are improperly processed. Template conntracks represent incomplete connection tracking objects that carry the IPS_TEMPLATE status flag but lack valid network tuple information required for proper hashing operations. When xt_cluster_mt() passes these template objects to xt_cluster_hash(), the function encounters a WARN_ON() condition due to the zeroed l3num field present in template conntracks, which should never be hashed as they represent incomplete connection tracking state.
This vulnerability has significant operational impact on systems relying on netfilter-based packet filtering and connection tracking, particularly those utilizing cluster matching rules in conjunction with raw table CT targets. The state confusion can lead to unpredictable behavior in connection tracking decisions, potentially allowing malicious actors to exploit the inconsistent connection tracking state to bypass security policies or cause system instability. The issue aligns with CWE-1283 which addresses improper handling of template objects in state management systems and corresponds to ATT&CK technique T1070.006 related to indicator removal through manipulation of system logs.
The mitigation strategy involves implementing proper rejection of template conntracks before they reach the hashing function, ensuring that only fully initialized conntrack objects undergo cluster matching operations. This approach mirrors existing netfilter handling patterns for template objects and prevents the hashing of incomplete connection tracking state. The fix requires modifying xt_cluster_mt() to check the conntrack status flags and explicitly reject objects marked with IPS_TEMPLATE status before passing them to xt_cluster_hash(), thereby maintaining consistency with established kernel security practices for connection tracking state management.